Re: [PATCH 2/3] tcp, udp, conf: Don't silently ignore listens on unsupported IP versions

[Stefano Brivio <sbrivio@redhat.com>]

On Mon, 12 Jan 2026 14:48:54 +1100
David Gibson <david@gibson.dropbear.id.au> wrote:

> On Sun, Jan 11, 2026 at 12:33:28AM +0100, Stefano Brivio wrote:
> > On Mon,  5 Jan 2026 19:28:49 +1100
> > David Gibson <david@gibson.dropbear.id.au> wrote:
> >   
> > > Currently, it's possible to explicitly ask for forwarding from an IPv4
> > > address, while disabling IPv4:
> > >     $ pasta -t 192.0.2.1/12345 -6
> > > or vice versa:
> > >     $ pasta -t 2001:db8::1/12345 -4
> > > 
> > > Currently, the impossible to implement forwarding option will be silently
> > > ignored.  That's potentially confusing since in a complex setup, it might
> > > not be obvious why the requested forward isn't taking effect.
> > > 
> > > Specifically, it's ignored at a fairly low level: tcp_listen() and
> > > udp_listen() ignore it and return 0.  Those run kind of late to give a
> > > good error message.  Change the low-level functions to return -EACCES
> > > (chosen because that's what the kernel will return if you request IPv6
> > > when it's disabled by sysctl).  
> > 
> > I couldn't quite find out in which case EACCES is returned by the
> > kernel. If I set /proc/sys/net/ipv6/conf/all/disable_ipv6 to 1 and then
> > bind() an IPv6 address, after setting IPV6_FREEBIND, I get 0.  
> 
> Huh.  EAFNOSUPPORT seems like it makes more sense, but oddly didn't
> spot it.  I was looking at:
> 
>     https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/net/ipv6/addrconf.c#n1098
>     https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/net/ipv6/addrconf.c#n2565
>     https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/net/ipv6/route.c#n3664

Weird, I guess it eventually gets translated to EOPNOTSUPP later
(perhaps in netlink code), because:

# strace ip addr add db8::1 dev ens3

[...]

recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=[{nlmsg_len=84, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=1768262003, nlmsg_pid=1598}, {error=-EOPNOTSUPP, msg=[{nlmsg_len=64, nlmsg_type=RTM_NEWADDR, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_EXCL|NLM_F_CREATE, nlmsg_seq=1768262003, nlmsg_pid=0}, {ifa_family=AF_INET6, ifa_prefixlen=128, ifa_flags=0, ifa_scope=RT_SCOPE_UNIVERSE, ifa_index=if_nametoindex("ens3")}, [[{nla_len=20, nla_type=IFA_LOCAL}, inet_pton(AF_INET6, "db8::1")], [{nla_len=20, nla_type=IFA_ADDRESS}, inet_pton(AF_INET6, "db8::1")]]]}], iov_len=32768}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 84
write(2, "RTNETLINK answers: Operation not"..., 43RTNETLINK answers: Operation not supported

it's EOPNOTSUPP in the NLMSG_ERROR message.

> Happy enough to change it to EAFNOSUPPORT if you'd prefer.

I think it would make a lot more sense, EACCES would confuse pretty
much anybody (and I can't get the kernel to return that over netlink
anyway).

> > If I disable IPv6 via command line (ipv6.disable=1) I get EAFNOSUPPORT
> > on bind(), and EOPNOTSUPP on setting addresses and routes. EACCES, I
> > couldn't quite spot it yet.  
> 
> Huh.  Kind of weird it only fails on bind(), not on socket().

Oops, I was fooled by the error message we print in that case. It
actually fails on socket():

socket(AF_INET6, SOCK_STREAM|SOCK_NONBLOCK, IPPROTO_TCP) = -1 EAFNOSUPPORT (Address family not supported by protocol)

but we print:

L4 socket: Address family not supported by protocol
Failed to bind port 2548 (Address family not supported by protocol) for option '-t 2b8::1/2548'

which makes sense because that's what we're doing with that port (just
not with that socket).

-- 
Stefano